"Hidden" historical WHOIS records
The Co-Chairman's declaration that my prior post was off-topic for this mailing list... an assertion that I take strong exception to... has at least had the salutary effect of reminding me of a number of what I consider to be "open issues" -- issues which ARE quite unambiguously on-topic for this mailing list, and which I first broached here way back around December 3rd: https://www.ripe.net/ripe/mail/archives/db-wg/2020-December/006736.html At that time and ever since I do not believe that I have seen any resoponse to the clear and pointed questions I posed in the message linked to above. I thus am now obliged to restate and reiterate those still-pending questions. As part of my effort to clarify my goals, vis a vis historical WHOIS transparency, back on December 3rd I threw out what I felt would be a perfectly ludicrous and absurd suggestion, just for retorical purposes, in order to try to make a point. I said something along the lines of "Hey why don't you all just make the entire RIPE WHOIS data base private rather than public?" I felt sure that when I did this that at least some of the denizens of this list... at least the few who might still care about either transparency or accountability... would immediately recognize the utter absurdity of my retorical suggestion, and that those folks, at least, would get up on their hind legs to vigorously protest any such move away from the longstanding and historical open and public nature of the WHOIS data base in all five regions. I was thus shocked and more than a little dismayed to see some of the folks here on this list taking my suggestion as something other than the lame joke and retorical device it was intended to be. Some folks here, it seems, would be entirely fine with hiding literally *everything* from the eyes of outside and independent investigators, including but not limited to me personally -- outside and independent investigators who's only goals are honesty, fairness, and a lack of thievery and self-dealing on the part of RIPE "insiders". I will not mince words. I find this type of position and this type of orientation, in favor of secrecy and against transparency, to be nothing less than shameful. Who does secrecy and darkness help other than the criminal element within the RIPE region? Some of you may still remember the discussion which I engaged in here, on and around December 3rd. For those that do not, the above link may be helpful in refreshing your memories. At that time the subject at hand was the availability, or lack thereof, of access to historical RIPE records, in particular (a) access to records that have since been purged from the data base and also (b) access to the historical versions of various ostensibly "privileged" record types, specifically PERSON, ROLE, and MNTNER records. As noted above, to this day I have never seen an answer to the basic question that I had asked, back on December 3rd about access to either or both of these two broad categories of historical data, and more specifically, who, if anyone, decided or approved, unilaterally or otherwise, the notion that either of these two broad categories of historical data should be made unavailable. Thus, I ask yet again, who made these decisions to hide what was at one time open and public WHOIS data? I certainly do not wish to draw any improper or unjustified inference from the lack of response on this key point, but it quite certainly does seem to be the case, from where I am sitting, that nobody much wants to talk about how these decisions were made, let alone who made them. So, once again: Who exactly decided that these two categories of historical WHOIS records should be unavailable? Was this a decision of the membership and/or the community? Were these decision points / policy points debated openly and fairly, taking into account what may perhaps be multiple divergent views on the matter? Or did certain people in positions of power just make these decisions entirely unilaterally and without ever consulting anyone? I look forward to some clarity here as regards to how these decisions were made and who made them. I hope that others on this list, even if you may disagree with my personal preference for total openness and transparency of the data base, will at least join me in hoping that all -decisions- relating to data base access should at least be made in the clear light of day, and in an open and transparent manner. Regards, rfg P.S. I remind everyone that during the discussion back in early December it was noted that a relevant policy proposal had already been lingering in a state of suspended animation for some years already. Perhaps someone can help me out here. I have been searching for the reference to the specific (still pending?) policy proposal in question but I can't seem to find it now.
Ronald, can you please deny or confirm if you are being paid for your posts ? article writers are being paid by the count of words, and your posts are seems to be usually very tedious, specially when you sometimes add more many words to explain and clarify basic technical terms, when you initially reaching out to a technical audience, like you are trying to make your posts as long as possible. I would ask you, and I'm sure that many have the same opinion, not to flood the mailing lists with long and tedious posts, write your posts shortly please, please ask your employers to be paid per posts and not per words. ________________________________ From: db-wg <db-wg-bounces@ripe.net> on behalf of Ronald F. Guilmette via db-wg <db-wg@ripe.net> Sent: Saturday, January 30, 2021 6:42 AM To: Database WG <db-wg@ripe.net> Subject: [db-wg] "Hidden" historical WHOIS records The Co-Chairman's declaration that my prior post was off-topic for this mailing list... an assertion that I take strong exception to... has at least had the salutary effect of reminding me of a number of what I consider to be "open issues" -- issues which ARE quite unambiguously on-topic for this mailing list, and which I first broached here way back around December 3rd: https://www.ripe.net/ripe/mail/archives/db-wg/2020-December/006736.html At that time and ever since I do not believe that I have seen any resoponse to the clear and pointed questions I posed in the message linked to above. I thus am now obliged to restate and reiterate those still-pending questions. As part of my effort to clarify my goals, vis a vis historical WHOIS transparency, back on December 3rd I threw out what I felt would be a perfectly ludicrous and absurd suggestion, just for retorical purposes, in order to try to make a point. I said something along the lines of "Hey why don't you all just make the entire RIPE WHOIS data base private rather than public?" I felt sure that when I did this that at least some of the denizens of this list... at least the few who might still care about either transparency or accountability... would immediately recognize the utter absurdity of my retorical suggestion, and that those folks, at least, would get up on their hind legs to vigorously protest any such move away from the longstanding and historical open and public nature of the WHOIS data base in all five regions. I was thus shocked and more than a little dismayed to see some of the folks here on this list taking my suggestion as something other than the lame joke and retorical device it was intended to be. Some folks here, it seems, would be entirely fine with hiding literally *everything* from the eyes of outside and independent investigators, including but not limited to me personally -- outside and independent investigators who's only goals are honesty, fairness, and a lack of thievery and self-dealing on the part of RIPE "insiders". I will not mince words. I find this type of position and this type of orientation, in favor of secrecy and against transparency, to be nothing less than shameful. Who does secrecy and darkness help other than the criminal element within the RIPE region? Some of you may still remember the discussion which I engaged in here, on and around December 3rd. For those that do not, the above link may be helpful in refreshing your memories. At that time the subject at hand was the availability, or lack thereof, of access to historical RIPE records, in particular (a) access to records that have since been purged from the data base and also (b) access to the historical versions of various ostensibly "privileged" record types, specifically PERSON, ROLE, and MNTNER records. As noted above, to this day I have never seen an answer to the basic question that I had asked, back on December 3rd about access to either or both of these two broad categories of historical data, and more specifically, who, if anyone, decided or approved, unilaterally or otherwise, the notion that either of these two broad categories of historical data should be made unavailable. Thus, I ask yet again, who made these decisions to hide what was at one time open and public WHOIS data? I certainly do not wish to draw any improper or unjustified inference from the lack of response on this key point, but it quite certainly does seem to be the case, from where I am sitting, that nobody much wants to talk about how these decisions were made, let alone who made them. So, once again: Who exactly decided that these two categories of historical WHOIS records should be unavailable? Was this a decision of the membership and/or the community? Were these decision points / policy points debated openly and fairly, taking into account what may perhaps be multiple divergent views on the matter? Or did certain people in positions of power just make these decisions entirely unilaterally and without ever consulting anyone? I look forward to some clarity here as regards to how these decisions were made and who made them. I hope that others on this list, even if you may disagree with my personal preference for total openness and transparency of the data base, will at least join me in hoping that all -decisions- relating to data base access should at least be made in the clear light of day, and in an open and transparent manner. Regards, rfg P.S. I remind everyone that during the discussion back in early December it was noted that a relevant policy proposal had already been lingering in a state of suspended animation for some years already. Perhaps someone can help me out here. I have been searching for the reference to the specific (still pending?) policy proposal in question but I can't seem to find it now.
Ronald, On 30/01/2021 05.42, Ronald F. Guilmette via db-wg wrote:
https://www.ripe.net/ripe/mail/archives/db-wg/2020-December/006736.html
When you refer to the two question that were ignored, I guess you mean:
True...historical versions of these objects are not available in any form for privacy and security reasons.
Ok, so, two questions:
1) Is that based on community policy, or on internal RIPE NCC policy?
2) What are these "privacy and security reasons", exactly?
Keep in mind that my participation in this was between 20 and 15 years ago, and my memory is likely imperfect and I invite other people involved to clarify or correct if they desire. As far as I know the ability to keep historical data was introduced with the implementation of the database deployed in 2000. I started working at the RIPE NCC a few months before the deployment and helped with the it, although I was not in a decision-making position at the time. Lack of historical data before that was not a matter of policy, but a limitation of the technology; the database before that did not keep older versions. During this era many ccTLD within the RIPE region (which at that time included Europe, the Middle East, and northern Africa) used the RIPE Database either as a primary or backup record of their domain delegations. This was a service provided by the RIPE NCC to help encourage the growth of the Internet within its service region; I believe that this fits in well with the stated purpose of the RIPE NCC, and was partially responsible for the success of ccTLD. The ccTLD data started to become a problem as various ccTLD became wildly popular, and domain objects and the associated objects (person, role, maintainer) consumed a large amount of storage, compute, and network resources. The large amount of personal data also highlighted the privacy problems associated with keeping such contact data, as there were lots of private information stored and published. When I mention "privacy problems", in 2000 the biggest concern of people was spam. Anti-spam techniques (both technical and legal) were in early days and the spammers were basically winning the arms race. There were no social platforms so e-mail was too important to ignore, but also becoming increasingly flooded. Given this, people were understandably very sensitive to having their e-mail address published. Given these issues, I do not think we ever considered providing access to historical data about person or role objects. I do not think it was removed, rather never provided. There were other ways that database data was available. The RIPE NCC was already providing daily dumps of the database on the FTP site for years before this, but I'm pretty sure the person and role objects were not available for download due to privacy concerns. At one point the dumps of other data types were modified to filter out references to person & role objects, to prevent people from getting a complete list of "active" persons or roles that they could then query. Additional filtering was added in the early 2000's such as removing CRYPT-PW and MD5-PW attributes to prevent dictionary attacks against maintainer passwords. The RIPE NCC also provided NRTM (near-real-time mirrors), which provided full information, although getting access to such a feed required a contract limiting how the information could be used or distributed. I believe such a full feed was eventually removed or more severely restricted as well. The RIPE NCC during that era worked closely with the community, and always presented such changes to the community beforehand and reported when they were complete. There was generally a presumption of good faith, which I think was deserved and I think the RIPE NCC still deserves. I'm not going to search through decades-old mailing list archives or review PowerPoint presentations from that time to garner the details; I leave that to historians, or to folks interested in litigating decisions made long ago. Cheers, -- Shane
Shane, On Mon, 1 Feb 2021, Shane Kerr via db-wg wrote: (...)
When I mention "privacy problems", in 2000 the biggest concern of people was spam. Anti-spam techniques (both technical and legal) were in early days and the spammers were basically winning the arms race.
Do you have any current data that says spammers (and fraudsters) are *not* winning the arms race *today*...? Regards, Carlos
participants (4)
-
Carlos Friaças
-
Elad Cohen
-
Ronald F. Guilmette
-
Shane Kerr